Privacy Policy

Last updated September 14, 2026.

This Privacy Policy explains how Plug collects, uses, discloses, and retains personal information when you visit our website, create an account, communicate with us, purchase or return a product, select a protection plan, use international checkout, or otherwise use our products and services.

Personal information we collect

The information we collect depends on how you interact with us.

We may create aggregated or deidentified information and use it for lawful business purposes. We will not attempt to reidentify information that applicable law requires us to maintain in deidentified form.

How we use personal information

We use personal information to:

• provide the website, accounts, checkout, payment, delivery, returns, warranties, alerts, reviews, wishlists, and support you request;
• process domestic and international transactions, including payment, tax, duty, customs, and delivery;
• secure accounts and transactions, detect fraud and abuse, and enforce our terms;
• record and enforce privacy choices;
• communicate service information and respond to questions and claims;
• maintain, troubleshoot, analyze, and improve our services;
• send marketing and personalize advertising where permitted by your choices and applicable law; and
• comply with legal obligations and establish, exercise, or defend legal claims.

Necessary service providers

We use certain service providers that are necessary to secure transactions, operate the storefront, and deliver services you request. These providers may operate without optional analytics or advertising consent only for the limited operational purposes described below and in our Cookie and Technology Schedule. They may not use that status as authorization for unrelated advertising or profiling.

Forter — fraud prevention and payment security

Forter may receive device, browser, and connection information; IP address; identifiers; site interactions and behavioral signals; account and contact information; and relevant order and payment metadata. It uses this information to detect fraud and abuse, optimize payment decisions, and return transaction recommendations. Forter's Data Processing Addendum describes Forter as a service provider or processor for these purposes and identifies these data categories.

SureBright — optional product-protection plans

When protection plans are offered or selected, SureBright may receive contact details; product and order information; warranty selection and transaction history; device and browser information; and later claim or support communications. It uses the information to display eligible protection offers, issue and service coverage, communicate plan information, and process claims. SureBright should not receive information unrelated to providing or administering the protection service. See the SureBright Privacy Policy.

Global-e — international checkout and fulfillment

When you use international checkout or fulfillment, Global-e may receive your name, email address, telephone number, delivery and billing address, payment information, IP and session information, and government identification information where customs law requires it. Global-e uses the information for international checkout, payment processing, fraud screening, tax and duty calculation, customs clearance, delivery, returns, and support.

Global-e may disclose relevant information to its affiliates, payment processors, carriers, customs brokers, fraud providers, and other fulfillment providers. Global-e states that it uses servers in Ireland and may transfer information among the European Union, Israel, the United Kingdom, and the United States. See the Global-e Consumer Privacy Policy.

Blotout/EdgeTag — consent management and permitted event routing

Blotout's EdgeTag processes consent preferences, device and browser information, IP address, cookie or similar identifiers, website events, and transaction signals to record privacy choices and route events only to destinations permitted by those choices and applicable law. EdgeTag itself is allowed to operate to enforce those choices; that does not make the analytics or advertising destinations it controls “necessary.” See the Blotout Privacy Policy.

Depending on your choices and applicable law, Plug uses Google Analytics and Google Ads through Google Tag Manager, Meta Pixel, Microsoft Advertising, Snapchat, Microsoft Clarity, and PostHog for analytics, advertising, attribution, measurement, and site improvement. These systems are optional and are subject to the applicable consent or legal condition.

Other necessary providers

We also use Shopify and Shop Pay for storefront and checkout functions; Kount and Google reCAPTCHA for fraud and abuse prevention; Swym for shopper-requested wishlists; Junip for reviews; Richpanel for support; Videowise for product-video functionality; Sentry for error monitoring; and content-delivery providers for required code, fonts, and assets. The linked schedule identifies their domains, data, purpose, retention criterion, recipients, and pre-consent status.

Cookies and similar technologies

We use cookies, pixels, local storage, software development kits, APIs, and similar technologies. Necessary technologies support security, checkout, services you select, consent controls, reliability, and required site content. Optional technologies support analytics, session measurement, personalization, and advertising.

Our Cookie and Technology Schedule explains the providers and domains used for each category. You can change optional choices through the Manage Preferences link in the site footer. Withdrawing consent does not affect processing that occurred lawfully before the withdrawal.

Klaviyo is not classified globally as necessary. If you request a specific service such as a back-in-stock alert, we may send Klaviyo the contact and product information you submit so it can provide that alert. Klaviyo's general tracking, profiling, and marketing forms remain subject to the applicable consent or legal condition.

Disclosures to service providers and other parties

We disclose relevant personal information to providers that help us operate the services, including ecommerce and hosting providers, payment processors, fraud and security providers, carriers and fulfillment providers, warranty providers, consent-management providers, communication and support providers, review and wishlist providers, analytics providers, advertising partners, professional advisers, and government or customs authorities where required.

We may also disclose information in a merger, financing, acquisition, bankruptcy, or sale of all or part of our business; to comply with law or legal process; or to protect rights, safety, property, users, and the public.

Sale, sharing, and targeted advertising

We do not sell personal information for money. Some privacy laws define “sale,” “sharing,” or “targeted advertising” broadly enough to include making online identifiers and website activity available to advertising partners for cross-context behavioral advertising. Where permitted by your choices and applicable law, Plug may make this information available to Google, Meta, Microsoft Advertising, and Snapchat for advertising, measurement, attribution, or audience services. Microsoft Clarity and PostHog are used for optional analytics and product measurement.

You may opt out of sale, sharing, or targeted advertising through Manage Preferences and any separate Your Privacy Choices control that Plug makes available. We do not knowingly sell or share the personal information of consumers under 16.

Automated decision-making

Forter, Shopify, payment processors, and other fraud providers may analyze device, account, behavioral, and transaction information to produce risk signals or recommendations. Plug or its payment providers may use those signals to approve, review, restrict, or decline a transaction and to prevent repeated fraudulent attempts.

Global Privacy Control and preference signals

Where legally required, Plug treats a recognized Global Privacy Control signal as a request to opt out of sale or sharing and targeted advertising for the browser or device that sends the signal. You may also use Manage Preferences to make granular choices. Because privacy signals are generally browser- and device-specific, you may need to repeat your choice on another browser or device.

Data retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including to provide services, maintain accounts, complete transactions and warranties, prevent fraud, resolve disputes and chargebacks, enforce agreements, and meet tax, accounting, customs, and other legal obligations. The criteria in the collection table and cookie schedule guide these decisions. We then delete or deidentify information unless law permits or requires continued retention.

International processing

Plug and its providers may process information in countries other than the one where you live. Those countries may have different data-protection laws. Where required, we use appropriate contractual or other safeguards. Global-e's international processing and transfers are described above and in its consumer privacy policy.

Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information. No transmission or storage method is completely secure, and we cannot guarantee absolute security.

Children

Our services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

Your privacy rights

Depending on where you live, you may have rights to request access to or a copy of personal information, learn about our collection and disclosures, correct inaccurate information, delete information, restrict or object to certain processing, obtain portable information, withdraw consent, or appeal a decision. You may also opt out of sale, sharing, or targeted advertising where applicable.

Submit a request through our privacy request form or email [email protected]. We may verify your identity and authority before completing a request. Applicable law may permit us to deny or limit a request, in which case we will explain our decision where required. An authorized agent may submit a request where allowed, subject to proof of authorization and identity verification. We will not discriminate against you for exercising a privacy right.

California privacy notice

This section supplements the rest of the policy for California residents. In the preceding 12 months, Plug may have collected the categories described below, used them for the business and commercial purposes described in this policy, and disclosed them to the listed recipient categories.

California residents may request:

• access to and knowledge of the categories, sources, purposes, recipients, and specific pieces of personal information we maintain;
• deletion of personal information, subject to exceptions;
• correction of inaccurate personal information;
• opt-out of sale or sharing of personal information;
• limitation of the use and disclosure of sensitive personal information if Plug uses it beyond purposes permitted without a limit right;
• equal service and pricing without unlawful discrimination for exercising CCPA rights; and
• use of an authorized agent, subject to applicable verification requirements.

Use Manage Preferences or the designated privacy-choice link to opt out of sale or sharing, and use the request methods above for other rights. We use information submitted with a request only as needed to verify and respond to it.

Changes to this policy

We may update this policy to reflect changes in our practices or legal requirements. We will post the revised policy with a new effective date and provide additional notice where required.

Contact us

For privacy questions or requests, contact:

Plug

[email protected]

8312 Page Ave

Overland, MO 63114

United States